Digital forensics, also known as computer forensics, is generally concerned with evidence of activities or occurrences on digital systems. This evidence may be found by examining storage media (e.g. hard disk drives) and/or memory (e.g. RAM). In this regard, digital forensics techniques may be applied to identify, examine, and analyze forensic data in a manner that may preserve the integrity of the information and maintain a strict chain of custody for the data. Analysis of forensic data may be used to support the investigation of crimes, violations of policies, security incidents, reviews of operational problems, and recovery from accidental system damage.
Forensic investigations often involve recovery or attempted recovery of allocated (e.g., non-deleted) and unallocated (e.g., deleted) files in a variety of formats. Various database file formats, such as SQLite, that are frequently used by computer programs on mobile devices such as smart phones, as well as computers, laptops, and other computers to store and organize data are of particular importance to many forensic investigations. For example, database records may be used to store a variety of functional data, including text messages, multimedia messages, email messages, call history entries, contact records, and the like. Such functional data records are often of great value in forensic investigations. As such, the ability to recover database records containing functional data may be of particular value for use in support of criminal investigations, civil litigation, corporate electronic discovery (e-discovery), and the like.